CVE-2026-42792 in OTP
Summary
by MITRE • 07/27/2026
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.
The do_accept function in erts/epmd/src/epmd_srv.c calls epmd_cleanup_exit() when accept(2) returns EMFILE (per-process file descriptor limit reached) or ENFILE (system-wide file descriptor limit reached), rather than treating these as recoverable conditions. An attacker can exhaust epmd's file descriptor slots by holding many TCP connections open while periodically sending a single byte to reset the idle timeout, then causing accept(2) to return EMFILE, which kills the daemon. epmd has no per-source-IP connection cap, making the attack feasible from a single source.
On Debian/Ubuntu default packaging the impact is amplified: the systemd unit inherits a low file descriptor soft limit, and repeated daemon deaths trigger systemd's start-rate-limit, permanently failing both epmd.service and epmd.socket and requiring manual operator intervention to recover.
This issue affects OTP from OTP 17.0 before OTP 27.3.4.15, 28.5.0.4, and 29.0.4.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability described represents a critical improper handling of exceptional conditions within the Erlang Port Mapper Daemon (epmd) component of Erlang OTP implementations. This weakness exists in the erts/epmd/src/epmd_srv.c file where the do_accept function fails to properly manage resource exhaustion scenarios. When the accept(2) system call returns either EMFILE or ENFILE error codes indicating that per-process or system-wide file descriptor limits have been reached, the function incorrectly invokes epmd_cleanup_exit() instead of treating these as recoverable conditions that should allow the daemon to continue operating. This design flaw creates a permanent termination scenario for epmd when attackers can systematically exhaust available connection slots through carefully orchestrated network activity.
The attack methodology leverages the fundamental TCP connection handling mechanisms to exploit this vulnerability by maintaining numerous open TCP connections while periodically sending single bytes to reset idle timeouts, effectively keeping connections alive without consuming significant bandwidth. This approach allows attackers to consume all available file descriptor slots allocated to epmd, causing subsequent accept(2) calls to return EMFILE errors that trigger the daemon's premature termination. The absence of per-source IP connection limiting capabilities in epmd makes this attack particularly effective as it can be executed from a single source address without requiring distributed attack resources or sophisticated network topology manipulation.
The operational impact extends beyond simple service disruption to create persistent daemon failure conditions that require manual intervention to resolve. This vulnerability affects all OTP versions from 17.0 through specific patched releases including 27.3.4.15, 28.5.0.4, and 29.0.4, representing a substantial attack surface across multiple major OTP release lines. The severity is amplified in Debian/Ubuntu environments where systemd unit configurations typically inherit low file descriptor soft limits, creating an environment where repeated epmd daemon failures trigger systemd's built-in start-rate-limiting mechanisms that permanently disable both epmd.service and epmd.socket units, effectively rendering the Erlang application hosting infrastructure completely non-functional until operator intervention occurs.
This vulnerability aligns with CWE-404, which describes improper resource management leading to resource exhaustion conditions, and represents a classic example of failing to properly handle exceptional system states during resource allocation operations. The attack pattern follows ATT&CK technique T1499.004 for network denial of service by consuming system resources, while also demonstrating characteristics of privilege escalation through resource exhaustion attacks that can lead to complete service compromise. The design flaw exemplifies poor error handling practices where recoverable conditions are treated as fatal errors without implementing proper fallback mechanisms or resource management strategies to maintain daemon availability during temporary resource constraints.
The remediation approach requires addressing the fundamental error handling logic in epmd's accept processing by implementing proper recovery mechanisms for EMFILE and ENFILE conditions rather than terminating the entire service. This involves modifying the do_accept function to gracefully handle file descriptor exhaustion scenarios through connection limiting, connection timeout management, or graceful degradation strategies that allow the daemon to continue operating while temporarily reducing service capacity. Additionally, system administrators should review and increase default file descriptor limits for epmd processes, particularly in Debian/Ubuntu environments where systemd unit configurations need adjustment to prevent automatic service disabling during legitimate resource exhaustion conditions.
The vulnerability demonstrates the critical importance of proper exception handling in network services that must maintain availability under various resource constraints. Modern security practices emphasize implementing robust error recovery mechanisms that prevent single points of failure from causing complete service termination, particularly in infrastructure components like port mappers that serve as essential entry points for distributed application communication systems. Organizations should implement monitoring and alerting for epmd service availability, establish automated recovery procedures, and ensure proper system configuration limits that allow services to gracefully handle resource exhaustion rather than failing completely.
This issue represents a fundamental design weakness in the Erlang OTP implementation that affects numerous applications relying on Erlang's distributed computing capabilities. The vulnerability has been addressed through targeted code modifications in patched versions that properly distinguish between fatal errors requiring service termination and recoverable conditions that should allow continued operation. However, administrators must ensure proper system configuration management to prevent the amplification effects seen in Debian/Ubuntu environments where default systemd configurations create additional attack surface for similar resource exhaustion scenarios across other services that may be similarly affected by inadequate file descriptor limit management.